177848 2017-10-03 17:38:32 -0700 REGRESSION (Safari 11): custom <font-face> tag crashes a page 2017-12-12 14:51:08 -0800 1 1 1 Unclassified WebKit CSS WebKit Nightly Build Mac macOS 10.12.4 RESOLVED FIXED InRadar P2 Normal --- 1 vladimirmetnew mmaxfield darin mmaxfield webkit-bug-importer oldest_to_newest 1356172 0 322618 vladimirmetnew 2017-10-03 17:38:32 -0700 Created attachment 322618 PoC `<font-face>` tag with attrs `font-family` and `font-style="initial"` and `<font-face-name name="anything">` crash page: Mac, latest Webkit with Asan (from git), tested on Safari Technology Preview too. ==60076==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000115b1d0b6 bp 0x7fff533cfbb0 sp 0x7fff533cfbb0 T0) ==60076==The signal is caused by a READ memory access. ==60076==Hint: address points to the zero page. ==60076==WARNING: invalid path to external symbolizer! ==60076==WARNING: Failed to use and restart external symbolizer! #0 0x115b1d0b5 in WebCore::CSSPrimitiveValue::valueID() const (/Users/metnev/Profile/fuzz/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1340b5) #1 0x115f71c29 in WebCore::calculateItalicRange(WebCore::CSSValue&) (/Users/metnev/Profile/fuzz/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x588c29) #2 0x115f7194b in WebCore::CSSFontFace::setStyle(WebCore::CSSValue&) (/Users/metnev/Profile/fuzz/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x58894b) #3 0x115fa1d23 in WebCore::CSSFontSelector::addFontFaceRule(WebCore::StyleRuleFontFace&, bool) (/Users/metnev/Profile/fuzz/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x5b8d23) #4 0x115fa112b in WebCore::CSSFontSelector::buildCompleted() (/Users/metnev/Profile/fuzz/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x5b812b) #5 0x118a3617b in WebCore::Style::Scope::resolver() (/Users/metnev/Profile/fuzz/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x304d17b) #6 0x118a4fcb6 in WebCore::Style::TreeResolver::Scope::Scope(WebCore::Document&) (/Users/metnev/Profile/fuzz/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3066cb6) #7 0x118a5357e in WebCore::Style::TreeResolver::resolve() (/Users/metnev/Profile/fuzz/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x306a57e) #8 0x1161d7afa in WebCore::Document::resolveStyle(WebCore::Document::ResolveStyleType) (/Users/metnev/Profile/fuzz/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x7eeafa) #9 0x1161d8ebc in WebCore::Document::updateStyleIfNeeded() (/Users/metnev/Profile/fuzz/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x7efebc) #10 0x118ccd892 in WebCore::ThreadTimers::sharedTimerFiredInternal() (/Users/metnev/Profile/fuzz/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x32e4892) #11 0x117de4d29 in WebCore::timerFired(__CFRunLoopTimer*, void*) (/Users/metnev/Profile/fuzz/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x23fbd29) #12 0x7fffb0f05c53 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x90c53) #13 0x7fffb0f058de in __CFRunLoopDoTimer (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x908de) #14 0x7fffb0f05439 in __CFRunLoopDoTimers (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x90439) #15 0x7fffb0efcb80 in __CFRunLoopRun (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x87b80) #16 0x7fffb0efc113 in CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x87113) #17 0x7fffb045cebb in RunCurrentEventLoopInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x30ebb) #18 0x7fffb045ccf0 in ReceiveNextEventCommon (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x30cf0) #19 0x7fffb045cb25 in _BlockUntilNextEventMatchingListInModeWithFilter (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x30b25) #20 0x7fffae9f5a53 in _DPSNextEvent (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x46a53) #21 0x7fffaf1717ed in -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x7c27ed) #22 0x7fffae9ea3da in -[NSApplication run] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x3b3da) #23 0x7fffae9b4e0d in NSApplicationMain (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x5e0d) #24 0x7fffc68dd8c6 in _xpc_objc_main (/usr/lib/system/libxpc.dylib:x86_64+0x108c6) #25 0x7fffc68dc2e3 in xpc_main (/usr/lib/system/libxpc.dylib:x86_64+0xf2e3) #26 0x10c82d4d6 in main (/Users/metnev/Profile/fuzz/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development:x86_64+0x1000014d6) #27 0x7fffc6684234 in start (/usr/lib/system/libdyld.dylib:x86_64+0x5234) ==60076==Register values: rax = 0x0000b00000000005 rbx = 0x00007fff533cfc20 rcx = 0x0000b00000000007 rdx = 0x0000160000000000 rdi = 0x0000b00000000001 rsi = 0x0000000119fe0258 rbp = 0x00007fff533cfbb0 rsp = 0x00007fff533cfbb0 r8 = 0x0000100000000000 r9 = 0x0000000000000000 r10 = 0x00000fffea679f00 r11 = 0x00000000000001c8 r12 = 0x0000000119fe0258 r13 = 0x0000000119fe0258 r14 = 0x00007fff533cfbc0 r15 = 0x00007fff533cfbe0 AddressSanitizer can not provide additional info. 1356212 1 webkit-bug-importer 2017-10-03 19:36:21 -0700 <rdar://problem/34805168> 1377227 2 328210 mmaxfield 2017-12-01 21:19:53 -0800 Created attachment 328210 Patch 1377523 3 328210 darin 2017-12-03 14:47:21 -0800 Comment on attachment 328210 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=328210&action=review > Source/WebCore/ChangeLog:11 > + the descriptors shouldn't accept the universal keywords ("initial", "inhert", etc.) and our typo: "inhert" > Source/WebCore/svg/SVGFontFaceElement.cpp:66 > CSSPropertyID propId = cssPropertyIdForSVGAttributeName(name); As long as we are touching this code, can we just write out the word "property" instead of using "prop"? > Source/WebCore/svg/SVGFontFaceElement.cpp:69 > + auto& mutableProperties = m_fontFaceRule->mutableProperties(); I don’t think this local variable name needs the word "mutable" in it. > Source/WebCore/svg/SVGFontFaceElement.cpp:70 > + mutableProperties.setProperty(propId, value, false); There is no need to pass the "false" here, it’s the default. Should take advantage of the return value of MutableStyleProperties::setProperty. If the function does nothing, then it returns false and we don’t have to do anything further. Could also skip the call to rebuildFontFace in that case. It’s really inelegant that we let the property get set and then remove it afterward, but I suppose we have to live with that for now. > Source/WebCore/svg/SVGFontFaceElement.cpp:72 > + // Because we're using a CSS property parser to parse a descriptor, we have to manually disallow the automatic keywords which all properties accept. I think the comment needs to go further and emphasize that we let the property get set, and now have to remove it. > Source/WebCore/svg/SVGFontFaceElement.cpp:74 > + if (parsedValue->isInheritedValue() || parsedValue->isInitialValue() || parsedValue->isUnsetValue() || parsedValue->isRevertValue()) I worry that this code needs to be updated if we add a new feature such as "revert" and the person working on CSSValue would have no reason to come here and update this code. Because of that, I suggest that instead of an explicit check for these four, you consider adding a function for this purpose in the CSSValue class. Or maybe you could list the types that are OK instead of the types that are forbidden. > Source/WebCore/svg/SVGFontFaceElement.cpp:75 > + mutableProperties.setProperty(propId, String(), false); No need to take advantage of the special case in setProperty, can just call removeProperty directly: mutableProperties.removeProperty(propId); > LayoutTests/svg/text/font-style-keyword.html:11 > + <font-face font-style="initial" font-family="any"> This tests one of the four keywords. We should at least test the three others. And still that seems like only modest test coverage given that there are separate rules for what is expected for each of the specific attributes. It is a really loose coupling that CSSFontFace makes assumptions based on how the CSSParser works, but with some layers of software in between. I think it might be even better to fix this by making CSSFontFace resilient to unexpected CSSValue types rather than having some of those functions assume they know exactly what the types are, while others have reason to and so carefully check type. 1380864 4 mmaxfield 2017-12-12 14:51:08 -0800 Committed r225808: <https://trac.webkit.org/changeset/225808> 322618 2017-10-03 17:38:32 -0700 2017-10-03 17:38:32 -0700 PoC font-face-crash.html text/html 235 vladimirmetnew PGh0bWw+Cgo8aGVhZD4KPC9oZWFkPgoKPGJvZHk+CiAgPHN2Zz4KICAgIDxmb250LWZhY2UgZm9u dC1zdHlsZT0iaW5pdGlhbCIgZm9udC1mYW1pbHk9ImFueSI+CiAgICAgIDxmb250LWZhY2Utc3Jj PgogICAgICAgIDxmb250LWZhY2UtbmFtZSBuYW1lPSJhbnkiPjwvZm9udC1mYWNlLW5hbWU+CiAg ICAgIDwvZm9udC1mYWNlLXNyYz4KICAgIDwvZm9udC1mYWNlPgogIDwvc3ZnPgo8L2JvZHk+Cgo8 L2h0bWw+Cg== 328210 2017-12-01 21:19:53 -0800 2017-12-03 14:47:21 -0800 Patch bug-177848-20171201211953.patch text/plain 4442 mmaxfield U3VidmVyc2lvbiBSZXZpc2lvbjogMjI1NDM2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMWU5MDQyMjZhOTNkNTg1 ZTFmMTQyZjI2YmM5OWRkM2ZkYzM4Y2VmMC4uNzg5OWMxZmQ3YzY0MGIyMDQ1MDE3NTFkOGE0Njg2 Y2VmZTllMWY1YiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIyIEBACisyMDE3LTEyLTAxICBNeWxl cyBDLiBNYXhmaWVsZCAgPG1tYXhmaWVsZEBhcHBsZS5jb20+CisKKyAgICAgICAgUkVHUkVTU0lP TiAoU2FmYXJpIDExKTogY3VzdG9tIDxmb250LWZhY2U+IHRhZyBjcmFzaGVzIGEgcGFnZQorICAg ICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTc3ODQ4CisKKyAg ICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgV2UgY3VycmVudGx5 IHVzZSB0aGUgQ1NTIHByb3BlcnR5IHBhcnNlcnMgdG8gcGFyc2UgU1ZHJ3MgPGZvbnQtZmFjZT4g ZWxlbWVudCBhdHRyaWJ1dGVzLiBJbnN0ZWFkLAorICAgICAgICB3ZSBzaG91bGQgYmUgdXNpbmcg dGhlIENTUyBkZXNjcmlwdG9yIHBhcnNlcnMgdG8gcGFyc2UgdGhlc2UgYXR0cmlidXRlcy4gSG93 ZXZlciwgdGhpcyBpcyBhCisgICAgICAgIGZhaXJseSBpbnZvbHZlZCB0YXNrLCBzbyB1bnRpbCBJ IGNhbiBmaW5pc2ggdGhhdCwgdGhpcyBwYXRjaCBmaXhlcyB0aGUgY3Jhc2guIFRoZSBjcmFzaCBp cyBzaW1wbGU7CisgICAgICAgIHRoZSBkZXNjcmlwdG9ycyBzaG91bGRuJ3QgYWNjZXB0IHRoZSB1 bml2ZXJzYWwga2V5d29yZHMgKCJpbml0aWFsIiwgImluaGVydCIsIGV0Yy4pIGFuZCBvdXIKKyAg ICAgICAgZm9udC1mYWNlIG1hY2hpbmVyeSBhc3N1bWVzIHRoaXMuIFNvIHRoZSBmaXggaXMganVz dCBkZXRlY3QgdGhlc2Uga2V5d29yZHMgYW5kIGV4cGxpY2l0bHkgZGlzYWxsb3cKKyAgICAgICAg dGhlbS4KKworICAgICAgICBUZXN0OiBzdmcvdGV4dC9mb250LXN0eWxlLWtleXdvcmQuaHRtbAor CisgICAgICAgICogc3ZnL1NWR0ZvbnRGYWNlRWxlbWVudC5jcHA6CisgICAgICAgIChXZWJDb3Jl OjpTVkdGb250RmFjZUVsZW1lbnQ6OnBhcnNlQXR0cmlidXRlKToKKwogMjAxNy0xMi0wMSAgRGFu aWVsIEJhdGVzICA8ZGFiYXRlc0BhcHBsZS5jb20+CiAKICAgICAgICAgQWx0ZXJuYXRpdmVQcmVz ZW50YXRpb25CdXR0b25TdWJzdGl0dXRpb246OnVuYXBwbHkoKSBtYXkgbm90IHVuZG8gc3Vic3Rp dHV0aW9uCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9zdmcvU1ZHRm9udEZhY2VFbGVtZW50 LmNwcCBiL1NvdXJjZS9XZWJDb3JlL3N2Zy9TVkdGb250RmFjZUVsZW1lbnQuY3BwCmluZGV4IDM3 MTNmNGJmMmRjZTcwNmU1ZmUxZDRlZWVkYTFiMWIzOWY5NGRhNzAuLmQwMTI0Zjc3ZDc5N2VkYWUy ZTFmOTE1MmQ0MzY0OGY0MTlhN2E1NWIgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL3N2Zy9T VkdGb250RmFjZUVsZW1lbnQuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL3N2Zy9TVkdGb250RmFj ZUVsZW1lbnQuY3BwCkBAIC02Niw3ICs2NiwxNSBAQCB2b2lkIFNWR0ZvbnRGYWNlRWxlbWVudDo6 cGFyc2VBdHRyaWJ1dGUoY29uc3QgUXVhbGlmaWVkTmFtZSYgbmFtZSwgY29uc3QgQXRvbWljUwog ICAgIENTU1Byb3BlcnR5SUQgcHJvcElkID0gY3NzUHJvcGVydHlJZEZvclNWR0F0dHJpYnV0ZU5h bWUobmFtZSk7CiAgICAgaWYgKHByb3BJZCA+IDApIHsKICAgICAgICAgLy8gRklYTUU6IFBhcnNl IHVzaW5nIHRoZSBAZm9udC1mYWNlIGRlc2NyaXB0b3IgZ3JhbW1hcnMsIG5vdCB0aGUgcHJvcGVy dHkgZ3JhbW1hcnMuCi0gICAgICAgIG1fZm9udEZhY2VSdWxlLT5tdXRhYmxlUHJvcGVydGllcygp LnNldFByb3BlcnR5KHByb3BJZCwgdmFsdWUsIGZhbHNlKTsKKyAgICAgICAgYXV0byYgbXV0YWJs ZVByb3BlcnRpZXMgPSBtX2ZvbnRGYWNlUnVsZS0+bXV0YWJsZVByb3BlcnRpZXMoKTsKKyAgICAg ICAgbXV0YWJsZVByb3BlcnRpZXMuc2V0UHJvcGVydHkocHJvcElkLCB2YWx1ZSwgZmFsc2UpOwor CisgICAgICAgIC8vIEJlY2F1c2Ugd2UncmUgdXNpbmcgYSBDU1MgcHJvcGVydHkgcGFyc2VyIHRv IHBhcnNlIGEgZGVzY3JpcHRvciwgd2UgaGF2ZSB0byBtYW51YWxseSBkaXNhbGxvdyB0aGUgYXV0 b21hdGljIGtleXdvcmRzIHdoaWNoIGFsbCBwcm9wZXJ0aWVzIGFjY2VwdC4KKyAgICAgICAgaWYg KGF1dG8gcGFyc2VkVmFsdWUgPSBtdXRhYmxlUHJvcGVydGllcy5nZXRQcm9wZXJ0eUNTU1ZhbHVl KHByb3BJZCkpIHsKKyAgICAgICAgICAgIGlmIChwYXJzZWRWYWx1ZS0+aXNJbmhlcml0ZWRWYWx1 ZSgpIHx8IHBhcnNlZFZhbHVlLT5pc0luaXRpYWxWYWx1ZSgpIHx8IHBhcnNlZFZhbHVlLT5pc1Vu c2V0VmFsdWUoKSB8fCBwYXJzZWRWYWx1ZS0+aXNSZXZlcnRWYWx1ZSgpKQorICAgICAgICAgICAg ICAgIG11dGFibGVQcm9wZXJ0aWVzLnNldFByb3BlcnR5KHByb3BJZCwgU3RyaW5nKCksIGZhbHNl KTsKKyAgICAgICAgfQorCiAgICAgICAgIHJlYnVpbGRGb250RmFjZSgpOwogICAgICAgICByZXR1 cm47CiAgICAgfQpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nIGIvTGF5b3V0VGVz dHMvQ2hhbmdlTG9nCmluZGV4IDhkMzNjYTBjNGE1ZjkxMTg1MmZkMjhhZDM5Yzk4MWM3M2IwYjk0 MTguLmZkMTJjNjJhM2JmNmEyODA1Yzg5MzYwODljZjE0ZWVkNjY1NGFhM2IgMTAwNjQ0Ci0tLSBh L0xheW91dFRlc3RzL0NoYW5nZUxvZworKysgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxMyBAQAorMjAxNy0xMi0wMSAgTXlsZXMgQy4gTWF4ZmllbGQgIDxtbWF4ZmllbGRAYXBw bGUuY29tPgorCisgICAgICAgIFJFR1JFU1NJT04gKFNhZmFyaSAxMSk6IGN1c3RvbSA8Zm9udC1m YWNlPiB0YWcgY3Jhc2hlcyBhIHBhZ2UKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcv c2hvd19idWcuY2dpP2lkPTE3Nzg0OAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09Q UyEpLgorCisgICAgICAgICogc3ZnL3RleHQvZm9udC1zdHlsZS1rZXl3b3JkLWV4cGVjdGVkLnR4 dDogQWRkZWQuCisgICAgICAgICogc3ZnL3RleHQvZm9udC1zdHlsZS1rZXl3b3JkLmh0bWw6IEFk ZGVkLgorCiAyMDE3LTEyLTAxICBNYXR0IExld2lzICA8amxld2lzM0BhcHBsZS5jb20+CiAKICAg ICAgICAgTWFya2VkIGltcG9ydGVkL3czYy93ZWItcGxhdGZvcm0tdGVzdHMvSW5kZXhlZERCL29w ZW4tcmVxdWVzdC1xdWV1ZS5odG1sIGFzIGZsYWt5IHRpbWVvdXQgb24gd2sxLgpkaWZmIC0tZ2l0 IGEvTGF5b3V0VGVzdHMvc3ZnL3RleHQvZm9udC1zdHlsZS1rZXl3b3JkLWV4cGVjdGVkLnR4dCBi L0xheW91dFRlc3RzL3N2Zy90ZXh0L2ZvbnQtc3R5bGUta2V5d29yZC1leHBlY3RlZC50eHQKbmV3 IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMC4uOGIxMzc4OTE3OTFmZTk2OTI3YWQ3OGU2NGIwYWFkN2JkZWQwOGJkYwotLS0gL2Rl di9udWxsCisrKyBiL0xheW91dFRlc3RzL3N2Zy90ZXh0L2ZvbnQtc3R5bGUta2V5d29yZC1leHBl Y3RlZC50eHQKQEAgLTAsMCArMSBAQAorCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9zdmcvdGV4 dC9mb250LXN0eWxlLWtleXdvcmQuaHRtbCBiL0xheW91dFRlc3RzL3N2Zy90ZXh0L2ZvbnQtc3R5 bGUta2V5d29yZC5odG1sCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAuLjA1ODI5YTQ4YzhiODE4NzFlNjJkZmJhMjFmZTI3 ZTdjNzk1MTFlYzAKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9zdmcvdGV4dC9mb250 LXN0eWxlLWtleXdvcmQuaHRtbApAQCAtMCwwICsxLDE5IEBACis8aHRtbD4KKzxoZWFkPgorPC9o ZWFkPgorPGJvZHk+Cis8IS0tIFRoaXMgdGVzdCBtYWtlcyBzdXJlIHRoZXJlIGlzIG5vIGNyYXNo IHdoZW4gc3BlY2lmeWluZyAiZm9udC1zdHlsZT1pbml0aWFsIiBvbiBhIDxmb250LWZhY2U+IGVs ZW1lbnQuIFRoZSB0ZXN0IHBhc3NlcyBpZiB0aGVyZSBpcyBubyBjcmFzaC4gLS0+Cis8c2NyaXB0 PgoraWYgKHdpbmRvdy50ZXN0UnVubmVyKQorICAgIHRlc3RSdW5uZXIuZHVtcEFzVGV4dCgpOwor PC9zY3JpcHQ+CisgIDxzdmc+CisgICAgPGZvbnQtZmFjZSBmb250LXN0eWxlPSJpbml0aWFsIiBm b250LWZhbWlseT0iYW55Ij4KKyAgICAgIDxmb250LWZhY2Utc3JjPgorICAgICAgICA8Zm9udC1m YWNlLW5hbWUgbmFtZT0iYW55Ij48L2ZvbnQtZmFjZS1uYW1lPgorICAgICAgPC9mb250LWZhY2Ut c3JjPgorICAgIDwvZm9udC1mYWNlPgorICA8L3N2Zz4KKzwvYm9keT4KKworPC9odG1sPgo=